# Google Search Poisoning Delivers Trojanized PuTTY MSI with Node.js Loader and EtherHiding C2 Targeting IT Administrators > A campaign poisons Google Search results to lure IT administrators searching for PuTTY to a spoofed download site (puty.ink) that serves a trojanized MSI (Putty-x86_64.msi). The installer runs a genuine Sectigo-signed PuTTY 0.85 as a decoy while deploying a Node.js-based loader that resolves its C2 through an Ethereum smart contract (EtherHiding) and supports reconnaissance, browser profile/cookie theft and near-live screen streaming. Reported by Palo Alto Networks Unit 42 on 2026-10-12. - **Published:** 2026-10-14T20:33:01Z - **Last reviewed:** 2026-10-14T20:33:01Z - **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3548 - **ID:** TL-2026-3548 - **Severity:** HIGH - **Category:** MALWARE - **Status:** ACTIVE - **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier) ## Description Unit 42 documented a campaign in which SEO-poisoned Google results for "PuTTY" / "PuTTY download" lead victims to a look-alike site, puty.ink (registered 2026-09-28), via a redirect hop at putredirhelps.online. The site delivers Putty-x86_64.msi from a third-party Backblaze B2 bucket (pattern https://.s3.us-east-005.backblazeb2.com/, observed bucket mnb61ak51). The target audience is IT administrators, whose workstations commonly hold privileged SSH sessions, saved credentials, browser sessions to admin consoles and network reach into server estates. The MSI drops four files into C:\Users\\AppData\Local\idejDHjFnNXb\: a legitimate, unmodified Sectigo-signed putty.exe (PuTTY 0.85) used as a decoy that opens a normal PuTTY window, an obfuscated batch loader (44JYYsqg.cmd), a 123-byte JScript trampoline (BdbEinqaL7.js) and an obfuscated JavaScript payload stored with an .ini extension (k3TjneJGcwI7.ini). The installer window title KS2FyWDqck and the staging directory name are hardcoded and identical across infections. The batch loader hides its console, checks for an existing Node.js installation and, if none is found, downloads the official Node.js 18.20.5 runtime from nodejs.org via curl and extracts it to the vXA8Jj subdirectory (a bring-your-own-interpreter approach). The JScript trampoline then launches node.exe invisibly via COM ShellExecute with the .ini payload as its argument. The Node.js payload resolves its command server using EtherHiding: it issues JSON-RPC eth_call requests to the reader contract 0x89F5664d6fD8d990FA04F53253Be4855ed481A74 (function selector 0x7d434425, campaign argument 0x4e7b6e29ab5f4c01e3b9f86a3558a2d99ae0cbaf) through seven public Ethereum RPC endpoints, and uses the most common valid URL returned as the C2 address. The C2 address is refreshed every five minutes, with a hardcoded fallback of presanis.com (registered 2026-09-15). The implant polls the C2 about every 500 ms using requests shaped like static asset fetches: /api/<4-byte-hex>//<4-byte-hex>.?=, where the build/campaign ID 1835187f-121a-4103-832f-24649a461cac is sent on every poll. Responses longer than 10 bytes are executed in-process with JavaScript new Function(), giving the operator code execution with full Node.js access (require, process, Buffer, console). Because the contract can be updated on-chain, the operator can rotate C2 infrastructure without modifying deployed payloads. Post-compromise, operators pushed hands-on-keyboard payloads: host reconnaissance (OS version, locale, GPU/graphics hardware, installed antivirus products, domain membership, MachineGuid, active SMB sessions), browser profile and session-cookie collection with transfers reaching hundreds of megabytes, npm installation of a WebSocket package, and a PowerShell loop capturing roughly five desktop screenshots per second as base64 JPEGs written to %LOCALAPPDATA%\Temp\stream__.txt for near-live screen streaming. No malware family name or threat actor attribution has been published; the activity is unattributed. Note: sources describe the loader behavior but do not document a distinct persistence mechanism beyond the staged files. ## MITRE ATT&CK - T1583.001 Domains - T1608.006 SEO Poisoning - T1608.001 Upload Malware - T1204.002 Malicious File - T1059.003 Windows Command Shell - T1059.007 JavaScript - T1059.001 PowerShell - T1218.007 Msiexec - T1027 Obfuscated Files or Information - T1036 Masquerading - T1082 System Information Discovery - T1518.001 Security Software Discovery - T1049 System Network Connections Discovery - T1539 Steal Web Session Cookie - T1113 Screen Capture - T1074.001 Local Data Staging - T1568 Dynamic Resolution - T1071.001 Web Protocols ## Sources - [Hackers Abuse Google Search to Attacks ITadmins with Weaponized PuTTY Installer](https://cybersecuritynews.com/hackers-abuse-google-search/) - [Unit 42 Timely Threat Intel: MSI impersonating PuTTY delivers malware](https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-12-MSI-impersonating-PuTTY-delivers-malware.txt) - [Hackers Target PuTTY Users With SEO Poisoning and Ethereum-Powered Malware (GBHackers)](https://gbhackers.com/ethereum-powered-malware/) - [Hackers Abuse Google Search to Attack IT Admins with Weaponized PuTTY Installer (Cryptika)](https://www.cryptika.com/hackers-abuse-google-search-to-attacks-itadmins-with-weaponized-putty-installer/) - [Usan Google para atacar administradores con PuTTY modificado (elhacker.NET)](https://blog.elhacker.net/2026/10/usan-google-para-atacar-administradores.html) - [Unit 42 Timely Threat Intel repository (Palo Alto Networks)](https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel) ## Full data Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp Canonical: https://intel.threadlinqs.com/threat/TL-2026-3548